{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:08ec5fc5-8927-545e-a684-390993b2227d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.0.11-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.0.11-tuxcare.6",
      "version": "6.0.11-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.0.11",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.0.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:5e7fc4db-cb3e-597a-8683-d1053f6601a5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 is NOT present in spring-framework 6.0.11-tuxcare.6. The vulnerability involved case-sensitive pattern matching in DataBinder's disallowedFields, allowing attackers to bypass field restrictions by varying the case of parameter names (e.g., \"Id\" vs \"id\"). The upstream fix by Sam Brannen (commit a7cf19cec5, April 2022) made disallowedFields matching case-insensitive by converting b...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.0.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:55c5d32a-ebf6-5722-a4b2-6977f68e997e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38820 affects version 6.0.11-tuxcare.6 of org.springframework:spring-context, and is fixed in 6.0.11-tuxcare.8."
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.0.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:19dfa7e3-c65b-5cb8-bafc-931cec4fed8a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 6.0.11-tuxcare.6 of org.springframework:spring-context, and is fixed in 6.0.11-tuxcare.9."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.0.11-tuxcare.6"
    }
  ]
}